CVE-2026-27960

OpenCTI privilege escalation and unauthenticated access via default admin account

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. In versions 6.6.0 through 6.9.12, there is a privilege escalation vulnerability that can be exploited by unauthenticated attackers to query the API as any existing user, including the default admin account. This issue has been fixed in version 6.9.13. As a workaround, the default admin can be disabled using the `APP__ADMIN__EXTERNALLY_MANAGED` configuration.

Affected

OpenCTI-Platform · opencti

CVSS v3.1 GITHUB

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

4.68% chance of exploitation in the next 30 days, 92nd percentile

Nuclei

critical · CWE-287

Published

2026-05-05

Updated

2026-05-06

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-27960.yaml

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/opencti_notifier_rce…

Security advisories

• OpenCTI-Platform/opencti/security/advisories/GHSA-6vvv-vmfr-xhrx

References

• CVE Record
• NVD entry